GHSA-9wcp-9r3j-383q

n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`

Source: GitHub Advisory Database (reviewed) High CVE-2026-65592

Packages

Ecosystem	Package	Affected	Fixed in
npm	n8n	< 1.123.64	1.123.64
npm	n8n	>= 2.30.0, < 2.30.1	2.30.1
npm	n8n	>= 2.0.0-rc.0, < 2.29.8	2.29.8

Details

As written in the advisory (Markdown source, shown as plain text).

## Impact The Resource Locator passes the workflow-persisted `cachedResultUrl` to `window.open()` without scheme validation. When a victim opens the crafted workflow and interact with external links, the JavaScript payload runs in the victim's browser. ## Patches The issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict workflow creation and editing permissions to fully trusted users only. - Audit existing workflows for unexpected `cachedResultUrl` values containing non-HTTP(S) schemes. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

References

External links from the advisory. They lead to third-party sites.